15568 matches found
Amazon Linux 2023 : composer (ALAS2023-2024-650)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-650 advisory. Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially...
Important: pki-core
Issue Overview: A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to...
Amazon Linux 2 : firefox (ALASFIREFOX-2024-026)
The version of firefox installed on the remote host is prior to 115.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-026 advisory. RESERVEDNOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2022-30/CVE-2022-2205 CVE-2022-2205 An attack...
Important: kernel
Issue Overview: kernel: Type confusion in picknextrtentity, which can result in memory corruption. CVE-2023-1077 In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio - Fix race on dataavail and actual data CVE-2023-53998 Affected Packages: kernel Note: This advisory i...
Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-074)
The version of kernel installed on the remote host is prior to 5.4.277-190.375. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-074 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch...
Medium: harfbuzz
Issue Overview: hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger On^2 growth via consecutive marks during the process of looking back for base glyphs when attaching marks. CVE-2023-25193 Affected Packages: harfbuzz Note: This advisory is applicable to Amazon Linux 2...
Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-063)
The version of kernel installed on the remote host is prior to 5.10.219-208.866. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2024-063 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-3697...
Medium: kernel
Issue Overview: In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-36971 Affected Packages: kernel Note: This advisory is applicable to Amazon Linux 2 - Kernel-5.10 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and...
The vulnerabilities of the Analyst component, Web Player, and Automation Services of the Spotfire Analyst platform, as well as the Spotfire Server and AWS Spotfire for AWS Marketplace analytical platforms, allow attackers to execute arbitrary code.
The vulnerabilities of the Analyst component, Web Player, and Automation Services of the Spotfire Analyst platform, as well as the Spotfire Server and the analytics platform based on cloud services AWS Spotfire for AWS Marketplace, are related to insufficient validation of input data. Exploiting...
Amazon S3 Browser Security Vulnerability
Amazon S3 Browser is a web-based online storage service by Amazon.com, Inc. enables users to easily store files on a web server. A security vulnerability exists in Amazon S3 Browser versions v.11.4.5 and v.10.9.9, which stems from a vulnerability that could allow a remote attacker to gain access ...
Amazon Linux AMI : kernel (ALAS-2024-1943)
The version of kernel installed on the remote host is prior to 4.14.348-187.565. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1943 advisory. In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Disable kvmclock on all CPUs on shutdown...
Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2024-649)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-649 advisory. A signal handler race condition was found in OpenSSH's server sshd, where a client does not authenticate within LoginGraceTime seconds 120 by default, 600 in old OpenSSH versions, then sshd's SIGALRM...
Security Bulletin: Denial of service vulnerability in Amazon Ion may affect IBM Storage Protect Server
Summary IBM Storage Protect Server may be affected by denial of service caused by stack-based overflow in Amazon Ion. CVE-2024-21634. Vulnerability Details CVEID:CVE-2024-21634 DESCRIPTION: Amazon Ion is vulnerable to a denial of service, caused by a stack-based overflow in ion-java for...
Medium: golang
Issue Overview: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip...
Amazon Is Investigating Perplexity Over Claims of Scraping Abuse
AWS hosted a server linked to the Bezos family- and Nvidia-backed search startup that appears to have been used to scrape the sites of major outlets, prompting an inquiry into potential rules violations...
WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh Patchstack Alliance in WordPress Plugin WP-Lister Lite for Amazon versions = 2.6.16...
VulnCheck KEV: CVE-2024-37261
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through = 2.6.16...
WordPress WP-Lister Lite for Amazon Plugin <= 2.6.16 is vulnerable to Cross Site Scripting (XSS)
Software WP-Lister Lite for Amazon Type Plugin Vulnerable versions = 2.6.16 Fixed in 2.6.17 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37261 Patch priority Medium CVSS severity Medium 7.1 Developer WP Lab PSID 6ad653dd30ed Credits Le Ngoc Anh Required privileg...
Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2024-002)
The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2024-002 advisory. A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound gro...
